<html>
<head><meta charset="utf-8"><title>compartive-unsafety · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html">compartive-unsafety</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="207201836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207201836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207201836">(Aug 17 2020 at 22:00)</a>:</h4>
<p><a href="https://flak.tedunangst.com/post/comparative-unsafety">https://flak.tedunangst.com/post/comparative-unsafety</a> probably of interest to folks. (I'm one of the people who reported the issue to Ted, and IIRC we added that lint to clippy after a previous wg-secure-code finding)</p>



<a name="207208388"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207208388" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207208388">(Aug 17 2020 at 23:22)</a>:</h4>
<blockquote>
<p>Given the focus of rust, it just feels like this error slipped between the cracks of should have been caught by the compiler and actually caught by the thing that tells me I'm not allowed to use w, x, y, and z variable names.</p>
</blockquote>
<p>How hard would this be to move to the compiler itself?</p>



<a name="207208425"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207208425" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207208425">(Aug 17 2020 at 23:23)</a>:</h4>
<p>Adding new lints is backwards compatible so there's no theoretical reason not to</p>



<a name="207208514"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207208514" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207208514">(Aug 17 2020 at 23:24)</a>:</h4>
<p>I assume it's possible. And indeed I see a thread on internal about it.</p>



<a name="207208551"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207208551" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207208551">(Aug 17 2020 at 23:25)</a>:</h4>
<blockquote>
<p>The error in the rust code isn't in the code. It's in the invisible spaces, the gaps between the code. </p>
</blockquote>
<p>I think <span class="user-mention" data-user-id="256759">@boats</span> mentioned something like this after fixing the use-after-free bugs in their io_uring wrapper</p>



<a name="207214498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207214498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207214498">(Aug 18 2020 at 01:09)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/issues/53224">https://github.com/rust-lang/rust/issues/53224</a> is an issue about moving this lint and a bunch of others into rustc. There's nothing really blocking it other than someone actually doing the work. I'm not familiar with the relevant infrastructure, but it from what I hear it's not complicated to move a lint from clippy to rustc.</p>



<a name="207215310"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207215310" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lzutao <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207215310">(Aug 18 2020 at 01:26)</a>:</h4>
<p>Need an RFC or MCP.</p>



<a name="207215354"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207215354" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207215354">(Aug 18 2020 at 01:27)</a>:</h4>
<p>Last time I opened an RFC I had to wait on a review for months and was told to open a PR instead. So in this case I'd start with a PR, and people will direct you to an RFC if needed.</p>



<a name="207216464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207216464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lzutao <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207216464">(Aug 18 2020 at 01:52)</a>:</h4>
<p>I mean there is an effort to add <a href="https://github.com/rust-lang/rust/pull/75573">const-mutable lint</a> in rustc. But devs suggest opening an MCP or RFC.</p>



<a name="207227811"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207227811" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207227811">(Aug 18 2020 at 06:41)</a>:</h4>
<p>I dont think I have ever seen an RFC for a lint^^</p>



<a name="207227857"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207227857" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207227857">(Aug 18 2020 at 06:42)</a>:</h4>
<p>ecxept maybe my unsafe_op_in_unsafe_fn, but that's a special case</p>



<a name="207227866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207227866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207227866">(Aug 18 2020 at 06:42)</a>:</h4>
<p>lints are easy to change and have hardly any stability guarantee, so an MCP should be more than enough</p>



<a name="207227899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207227899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207227899">(Aug 18 2020 at 06:43)</a>:</h4>
<p><span class="user-mention" data-user-id="124288">@oli</span> was the one to say "new lints need an RFC"</p>



<a name="207228184"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207228184" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oli <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207228184">(Aug 18 2020 at 06:48)</a>:</h4>
<p>we didn't use to have MCPs, so we just blocked all new lints with "needs rfc". I just ended up adopting said policy, not trying to change it</p>



<a name="207236600"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236600" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207236600">(Aug 18 2020 at 08:46)</a>:</h4>
<p>i think uplifting clippy lints is a great example of where an MCP process would do way better than an RFC, because it allows gradual decision making on each lint</p>



<a name="207236645"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236645" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207236645">(Aug 18 2020 at 08:46)</a>:</h4>
<p>but I think this user really went wrong when he wrote his own bindings to <code>chown</code>; the libc bindings were not buggy, he's just always relied on C's implicit cast behavior to write uint MAX as <code>-1</code></p>



<a name="207236692"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236692" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207236692">(Aug 18 2020 at 08:47)</a>:</h4>
<p>(i think its pretty shocking to assume the libc crate has a buggy interface in this case, but whatever!)</p>



<a name="207236749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207236749">(Aug 18 2020 at 08:48)</a>:</h4>
<p>he mentions being led astray by the compiler's suggestion to use <code>try_into</code>. He would have been perfectly well supported if he had used an <code>as</code> cast, fwiw.</p>



<a name="207236785"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236785" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207236785">(Aug 18 2020 at 08:48)</a>:</h4>
<p>I think the hint should be refined so that if a user is casting a <code>-1</code> lit to an unsigned int they should be recommended <code>!0</code> or <code>uXX::MAX</code> or something</p>



<a name="207238662"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207238662" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207238662">(Aug 18 2020 at 09:14)</a>:</h4>
<p><span class="user-mention silent" data-user-id="256759">boats</span> <a href="#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236645">said</a>:</p>
<blockquote>
<p>but I think this user really went wrong when he wrote his own bindings to <code>chown</code>; the libc bindings were not buggy, he's just always relied on C's implicit cast behavior to write uint MAX as <code>-1</code></p>
</blockquote>
<p>he and the docs likewise. I agree the libc crate uses the right type, but it also becomes non-trivial then to pass <code>-1</code> -- to write <code>u32::MAX</code> you have to first figure out that <code>gid_t</code> is <code>u32</code>.</p>



<a name="207238704"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207238704" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207238704">(Aug 18 2020 at 09:15)</a>:</h4>
<p>hm, <code>!0</code> is an interesting alterantive that I was not aware of</p>



<a name="207238822"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207238822" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207238822">(Aug 18 2020 at 09:16)</a>:</h4>
<p><span class="user-mention silent" data-user-id="256759">boats</span> <a href="#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207236785">said</a>:</p>
<blockquote>
<p>I think the hint should be refined so that if a user is casting a <code>-1</code> lit to an unsigned int they should be recommended <code>!0</code> or <code>uXX::MAX</code> or something</p>
</blockquote>
<p>generally, it makes little sense to recommend <code>try_into</code> when the cast source is a constant and the lint can already know that try_into will fail</p>



<a name="207238844"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207238844" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207238844">(Aug 18 2020 at 09:16)</a>:</h4>
<p>(in general I think <code>try_into</code> is much better than <code>as</code>, just not in this case)</p>



<a name="207254322"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207254322" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207254322">(Aug 18 2020 at 12:46)</a>:</h4>
<p>heh, that blog post renders quite oddly for me</p>



<a name="207254332"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207254332" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207254332">(Aug 18 2020 at 12:47)</a>:</h4>
<p>every time the tab loses focus it goes back to the "loading" screen</p>



<a name="207254471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207254471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> lzutao <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207254471">(Aug 18 2020 at 12:48)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span>  I heard that's because the blog owner wants readers to disable js.</p>



<a name="207254480"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207254480" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207254480">(Aug 18 2020 at 12:48)</a>:</h4>
<p>hahaha</p>



<a name="207254523"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207254523" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207254523">(Aug 18 2020 at 12:49)</a>:</h4>
<p>I was trying to remember if <code>chown(&amp;path, ...</code> would auto-coerce from a reference type to a pointer i.e. in lieu of the <code>as_ref()</code></p>



<a name="207256912"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207256912" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/compartive-unsafety.html#207256912">(Aug 18 2020 at 13:09)</a>:</h4>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/compartive-unsafety/near/207254523">said</a>:</p>
<blockquote>
<p>I was trying to remember if <code>chown(&amp;path, ...</code> would auto-coerce from a reference type to a pointer i.e. in lieu of the <code>as_ref()</code></p>
</blockquote>
<p>yes</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>